PT-2023-19084 · Discourse · Discourse

Pmusaraj · Published 2023-01-27 · Updated 2024-03-06 · CVE-2023-23624

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.0.1 on the stable branch Discourse versions prior to 3.1.0.beta2 on the beta and tests-passed branches

Description The issue affects Discourse, an open-source discussion platform, where someone can use the exclude tag param to filter out topics and deduce which ones were using a specific hidden tag. This affects any Discourse site using hidden tags in public categories.

Recommendations For versions prior to 3.0.1 on the stable branch, update to version 3.0.1 or later. For versions prior to 3.1.0.beta2 on the beta and tests-passed branches, update to version 3.1.0.beta2 or later. As a temporary workaround, consider securing any categories that are using hidden tags, changing any existing hidden tags to not include private data, or removing any hidden tags currently in use.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-DISCOURSE-2023-23624

CVE-2023-23624

GHSA-QGJ5-G5VF-FM7Q

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23624.json · Exploit
• https://github.com/discourse/discourse/pull/20006 · Patch
• https://github.com/discourse/discourse/commit/f55e0fe7910149c431861c18ce407d1be0d6091a · Patch
• https://osv.dev/vulnerability/CVE-2023-23624 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23624 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2023-23624 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-qgj5-g5vf-fm7q · Note
• https://t.me/cibsecurity/57117 · Telegram Post